201209042000 zbwby

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 836

Metadata

Post ID: zbwby
Title: 201209042000 → 2012-09-04 20:00 on A858's clock
Posted (UTC): 2012-09-04 11:00:39
Timezone: UTC+9 · title 20:00 against posted 11:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209042000) = 480ee3b39a351c5fbc3c6aae81277f0f (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(836).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 60 · predicted N = 15 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8FB36DC5FD659569 2735ED13025C61A9 263046135E91A4A5 899695EA6A63510F B983BCC574BF241A AD82E707F186688A 77F2398A2AB98B1B B205D597C473ECC4 1DCED0F8771DA688 43EC4E9642EA32A5 EEE42C40091CAA32 992B7D9634637BAE D118C5E1C192B3A9 61C6D57015305D60 170A1E5B01AB5409 B9FA917701394A80 34C4C6B326B196B8 16E279A640CD03B3 D7D3B00A9D7BD727 EC26873FBB1D6CC3 3F46BE67AB1FD752 6BEA59F93306BD4F 0FA1433066CB383B 412E72D9103634FA 445C2EC071A379DC E9E58C2059D7D92C EDA8E6F96A283AC0 05F0389B4C1C56E1 03955CB406640C81 6F503859C4E5C014 0A81BB54E76D809B 077AD6E03691F1E1 09FB7031A391E3D5 0DDE4509D94F62BE C23678B98BE7183A B4A7478FA4930E57 87C39BAD5A0FCA85 CCA53402A7F1BB65 885078BC48289DB9 41695CB56D19E75F BC9D8564D96DF4EB D3B7013FD47FE92C 9EC02C94D41DA54E D250111C9917153B 9AC7B2FA273A0221 28B0C23C80E86D2D 59E7F97C0864785F 34D46742DEC5BE34 54409A1DE953C284 26F49CC0E2B543E1 9F9A0C5B3403FF10 71DAB155D0326139 BC76607CE75233DC CE1CE54FE6519D10 43626746393120A6 016A560F975E799C 4036A630AF929CF7 10EEBF20E492848A 216AFAA259131B9D 4B102CC1B8BA6B69 BCBA7BCE11580BD9

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209042000 (name+title). Key = MD5(password) = 480ee3b39a351c5fbc3c6aae81277f0f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7635e698-d582-4b78-a593-885b7eb14e27
  2 82464335-6710-13eb-b406-bc68797a3b4a
  3 a75d4d07-a694-164e-a5c4-5b0edce41cfa
  4 51b772c1-1a53-8826-ae3d-6cc804492d67
  5 6501f861-588f-5af2-800c-1a48de63fb49
  6 47b627b4-c75b-1197-ad3e-31112988a2c3
  7 3edf5af4-6936-44e3-837d-ff29b7a7c004
  8 7240b6a6-d972-7159-a1c8-ff0586c6468e
  9 852a4c6d-a06e-386e-b273-3a6a3e28931e
 10 8d1cb301-852a-42eb-a13c-5f492a9833ec
 11 597ab0f5-b940-157f-ab8b-a5960bceba6f
 12 9bad3a12-749b-1758-a5e1-0bfbf5c7c778
 13 a1480bfb-d487-3f38-88b7-d006c61f5fa1
 14 bbab48c4-2ead-38c9-ae1e-a674ddfe76db
 15 261930da-11b9-1f6c-af97-ea744cfc7947

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 411851473411331. Exactly this sequence comes out of new Random(836).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 60 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related